What it does
Attributes work below the normal permissions. A file with +i (immutable) cannot be changed, deleted, renamed or linked — not even by root — until the attribute is removed with chattr -i. With +a you can only add data at the end.
Only root (with the right capability) can set i and a. Support depends on the file system: ext4 knows many attributes; XFS supports a smaller set (like i, a, d, S, A, s… only some).
How to write it
chattr [-RVf] [-v VERSION] [-p PROJECT] [+-=ATTRIBUTES] FILE...Main parts
+-=- Add, remove, set exactly.
i- Immutable: no change, delete, rename, link.
a- Append only: only add data (good for logs).
A- Do not update the access time.
d- Skip the file in
dumpbackups. S- Write changes to disk at once (synchronous).
c- Compress (some file systems).
C- No copy-on-write (btrfs).
e- The file uses extents (ext4, cannot be removed).
u,s- Undeletable / secure delete (not used by ext4).
Options 5
Most used
Nothing matches this filter.
Examples 10
$ run as a normal user# run as root (or with sudo)
1Protect a file against every change
chattr +i /etc/resolv.confStops tools (and people) from changing DNS settings.
2Show the attributes
lsattr /etc/resolv.conf ----i----------------- /etc/resolv.confThe
iis set.3Even root cannot delete it
rm -f /etc/resolv.conf rm: cannot remove '/etc/resolv.conf': Operation not permittedRemove the attribute first.
4Remove the protection
chattr -i /etc/resolv.confNow normal permissions count again.
5Make a log file append only
chattr +a /var/log/app/audit.logAn attacker cannot delete old lines (but can add new ones).
6Protect important files against ransomware or mistakes
chattr -R +i /srv/archive/2025Old data that must never change.
7Find immutable files when a change fails
"Operation not permitted" as root often means
i.8Check for attacker tricks (security)
lsattr /etc/passwd /etc/shadow /root/.ssh/authorized_keysAttackers set
+ion their backdoor files so admins cannot remove them.9No access time updates for a busy file
chattr +A /srv/cache/data.dbFewer writes (most systems use relatime anyway).
10Set exactly these attributes
chattr =a /var/log/app/audit.logRemoves all others.
Nothing matches this filter.
Watch out
- An immutable file breaks updates: package updates and config tools fail on it. Document where you use it.
- Not all file systems support all attributes ("Operation not supported").
Exit codes
0 :: Done. 1 :: Error.